The vulnerability is a Contributor Cross‑Site Scripting flaw in the WordPress Strong Testimonials plugin up to version 3.3.11. It allows an attacker to inject malicious script through an untrusted input field, potentially subverting the integrity of the site’s content and enabling further exploitation such as session hijacking or defacement. The weakness falls under input validation failure (CWE‑79).

Affected systems are installations of the WP Chill Strong Testimonials plugin running any version up to and including 3.3.11. The vulnerability manifests when the plugin is enabled on a WordPress site and the contributor form or similar input gateway is exposed to the web. No specific WordPress core or theme version is mentioned.

The CVSS base score of 6.5 indicates a medium severity with potential for client‑side impact. The EPSS score of 0.00154 indicates a very low but non‑zero exploitation probability, suggesting that large‑scale targeted attacks are unlikely but opportunistic exploitation could occur. The vulnerability is not listed in the CISA KEV catalog, but absence from KEV does not preclude active exploitation; the plugin vendor has issued a fix in version 3.3.12. The likely attack vector is a web‑based submission of malicious input through the plugin’s contributor interface.